Guides & tools

API console

Paste a token and run a real request against the live API in your browser.

Paste an access token, pick a read-only endpoint and run a real request against the live GrivaOne API — right here in your browser. The response, status and X-Request-Id are shown inline, exactly as your own code would receive them.

Your token stays in this tab

The console runs entirely client-side. Your token is held only in memory for this browser tab, is never stored (no cookies, no localStorage) and is sent nowhere except to the GrivaOne API on the request you trigger. Close the tab and it is gone. Still, treat it as a live credential and use a low-privilege account where you can.

Access token

Your bearer access token from POST /auth/login. It stays in this browser tab only — it is never stored or sent anywhere except to the GrivaOne API on the request you run.

Endpoint

The current authenticated user and tenant context.

X-Company-Id (optional)

Selects the active company for multi-company tenants.

GET https://gulfpay-production.up.railway.app/api/v1/auth/me

What you can call here

The picker is intentionally limited to a handful of safe, read-only GET endpoints — /auth/me and the main list resources. There are no writes or deletes in the console; use the code samples for those against a test tenant.

Getting a token

Obtain an access token from POST /auth/login — see the quickstart. Tokens expire after 15 minutes; if a call returns 401, log in again for a fresh one.

Why a call might fail

A wrong or expired token returns a 401 response you will see below. A request that cannot complete at all is almost always a browser CORS restriction: the API only accepts cross-origin calls from allow-listed origins (the deployed developers.grivaone.com site or a localhost dev server), so the console works from those contexts.